State of the art machine learning algorithms can achieve high accuracies in classification tasks but misclassify minor perturbations in the data known as as adversarial attacks
[1]}, [2]}, [3]}, [4]}, [5]}. Adversarial examples have been shown to transfer across models which makes it possible to perform transfer-based (substitute model) black box attacks [6]}. To counter adversarial attacks many defense methods been proposed with adversarial training being the most popular [7]}. This is known to improve robustness to adversarial examples but also tends to lower accuracy on clean test data that has no perturbations [8]}, [9]}. Many previously proposed defenses have also shown to be vulnerable [4]}, [11]}, [12]} thus leaving adversarial robustness an open problem in machine learning.
